GRAYLOG - Chapter 1, Exercise 3 Solution
==========================================================
Writing a Combined Field-and-Phrase Query

PROBLEM
-------
Write a Lucene-style query that matches messages where the service
field is exactly ws-lite and the free-text content contains the exact
phrase connection refused.

SOLUTION
--------
Per this chapter's own syntax table:
  - An exact field match uses field:value -> service:ws-lite
  - An exact free-text phrase uses double quotes -> "connection refused"
  - Combining two required conditions uses AND

Combining all three:

    service:ws-lite AND "connection refused"

ANSWER: service:ws-lite AND "connection refused"

----
WHY THIS WORKS AS AN ANSWER

This is a direct, two-part application of this chapter's own syntax
table: service:ws-lite scopes the search to only messages from that one
structured field value, while the quoted phrase ensures Graylog matches
the exact wording "connection refused" together, in that order - rather
than matching any message that happens to contain the word "connection"
and the word "refused" separately, possibly far apart or in a different
order, which is what would happen if the phrase were left unquoted.